HiFuzz: Hierarchical Reinforcement Learning for Semantic-Aware and Adaptive CPU Fuzzing

2026-07-07

AI Summary

Traditional mutation-based fuzzing struggles to effectively explore deep architectural states of processors, leading to insufficient verification. This work proposes a hierarchical reinforcement learning framework in which a program-level agent plans test structures and a basic block–level agent generates semantic-aware RISC-V instruction sequences. To address the sparse reward problem inherent in coverage-guided testing, an adaptive coverage-based reward mechanism is introduced. Evaluated on three real-world RISC-V processor cores, the proposed approach significantly outperforms existing fuzzing tools, achieving state-of-the-art results in both instruction coverage and the number of discovered vulnerabilities.

Abstract

Modern processor verification struggles to reach deep architectural states due to the inefficiencies of traditional mutation-based fuzzing. We propose HiFuzz, a novel hierarchical reinforcement learning framework that replaces mutation with a structured, two-layer generation process: a Program Agent for global layout and a Basic Block Agent for precise instruction filling. To overcome reward sparsity, HiFuzz integrates an adaptive coverage reward mechanism and a semantic-aware basic block encoder providing intrinsic feedback. Extensive evaluations on three real-world RISC-V cores demonstrate that HiFuzz significantly outperforms state-of-the-art fuzzers in coverage and bug detection.

Problem

• processor verification
• fuzzing
• deep architectural states
• coverage
• bug detection

Innovation

• hierarchical reinforcement learning
• semantic-aware fuzzing
• adaptive coverage reward
• CPU verification
• RISC-V